Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes

ICS Patch Tuesday: Siemens, Schneider Electric Disclose High-Severity Vulnerabilities and Node2Shell Exposure

Siemens has released nine new security advisories covering ten vulnerabilities across multiple industrial products, including high-severity issues in ROS#, Simcenter Femap, Mendix Studio Pro MCP Server, Simatic SCADA, PCS 7, Meta-iot2050, and Simatic WinCC Graphics Designer. Two of the advisories address the impact of the Node2Shell vulnerability, with exploitation attempts already observed in the wild though no targeted attacks against Siemens products have been confirmed. Schneider Electric published one advisory for a medium-severity flaw in EcoStruxure Power Build Rapsody that could enable arbitrary code execution via malicious files. Germany’s VDE CERT issued eight advisories affecting Beckhoff, MB Connect Line, Helmholz, Weidmueller, Bender, and Ads-Tec products, many involving third-party components such as PHP2Shell. Phoenix Contact, Johnson Controls, and Hitachi Energy also released advisories detailing risks in PLCnext, EasyIO Neo IO Manager, C•CURE 9000, and other systems, with some products lacking available patches.

CISA Adds Cisco BroadWorks CVE-2026-20320 to KEV Catalog After Active Exploitation in Telecom Attacks

The US Cybersecurity and Infrastructure Security Agency has added the high-severity Cisco BroadWorks vulnerability CVE-2026-20320 to its Known Exploited Vulnerabilities Catalog, confirming active exploitation in the wild. The flaw stems from improper XML External Entity parsing in the Open Client Interface XML Parser, allowing unauthenticated remote attackers to read sensitive configuration files. Cisco patched the issue in August, but threat actors have since weaponized it against a European telecommunications provider and thirteen downstream organizations. Intelligence from Malbear Labs reveals the attack leveraged a jailbroken DeepSeek Flash AI model to exploit the BroadWorks XSP platform and extract private keys from the Provisioning Server. CISA has mandated federal agencies to remediate by November 24 under BOD 26-04 while urging all organizations to prioritize patching. This marks the 103rd Cisco vulnerability added to the KEV list since 2021.

Threat Actors Exploit Openwave and Cisco BroadWorks Vulnerabilities to Steal Sensitive Telecom Data

Threat actors are actively exploiting two vulnerabilities in Openwave Webtop Media Transcoder and Cisco BroadWorks to access sensitive information from communication service providers. The Openwave flaw, tracked as CVE-2026-111793, allows authenticated users to bypass file-type restrictions and convert unintended documents, potentially leading to sensitive data exposure. Patched in version 1.1.22.0 released in December 2021, the issue was added to CISA’s Known Exploited Vulnerabilities catalog on November 10. The Cisco BroadWorks vulnerability, CVE-2026-20320, is an unauthenticated blind XML external entity injection that enables remote attackers to read sensitive configuration data via the OCI-P service. Malbear Labs reported that a Chinese-speaking actor used an autonomous AI intrusion harness to target a European telecom provider and at least 13 of its customers, focusing on asset enumeration, credential theft, and subscriber record harvesting. CISA added both flaws to the KEV list with a November 24 patching deadline for federal agencies.